How password-only access to CPF statements compromises security

It used to be possible for a third party to retrieve a Central Provident Fund (CPF) statement over the counter if one had an authorisation letter, the CPF member’s National Registration Identity Card (NRIC) and one’s own NRIC.

I was surprised to learn that such requests are no longer approved; the only way to retrieve a statement is via password. The first thing that came to my mind was the report, “1,560 SingPass user accounts breached” (June 5).

Someone who is not information technology-savvy may need a relative’s assistance to access his account using his password. This means the third party could change the password and access the account without the CPF member’s knowledge.

While there are laws to bring offenders to court, it may be too late, for example, if someone makes an irreversible transaction from the Ordinary to the Special Account. The CPF Board should rethink this.

There are elderly or disabled people who may not be physically fit to visit a CPF branch. They may not have Internet access or know how to log in upon getting their password. A third-party request may be useful for these groups.

It can reduce the number of tampered accounts, as the third party would need the CPF member’s NRIC. The latter’s contact number could be another requirement, so CPF staff can make verifications in case of doubt. We should never compromise security for the sake of convenience.